Linux: File Permission System

By Xah Lee. Date:

This page is a tutorial on file permission system on unix/linux.

Unix File Permission System

Each File has One Owner

Here's a example of a file's permission when you do ls -al.

  drwxr-xr-x   40 root  wheel     1360 May 13 08:50 bin
      ↑            ↑      ↑                          ↑
     perm         owner   group                   file name

On unix, a file has a “owner” attribute. Owner is a login account name. Each file has one owner. (directory is also considered a file in unix) In the above example, the owner of the file “bin” is a login name named “root”.

Each File has One Group

A file also has a “group” attribute.

A group is a set of login names, and can be setup by sys admins.

For example, if the machine has logins of {jone, mary, david, joe}, a sys admin can create a group named “engineers”, and the group member can be {joe, david}, and there can be another group named “sales”, with membership of {jone, david, mary}. There can be any number of groups. Each login name can be in multiple groups. “owner” name and “group” name can be the same, but there's no special connecton.

By default, unix creates several groups. A common one is “wheel”, which is meant as a group name for “root”. (typicall, this group is for sys admins.)

Summary:

For creating new {user, group}, listing {user, group}, or find out their id , see: Linux: Users and Groups

File Attributes: {read, write, execute} for {owner, group, other}

Every file also has a permission attribute. Basically, the possible permissions are:

Together, these make a permission set, shown as “rwx”.

For each file, there are 3 sets of rwx permission. One is associated with the file's “owner”, one is associated with the file's “group”, and another is associated with special name called “other”, which means all those who are not owner or in the group).

So, typically, when you do ls -l in unix, you will see a lines like:

  drwxr-xr-x   40 root  wheel     1360 May 13 08:50 bin
      ↑            ↑      ↑                          ↑
     perm         owner   group                   file name

The “d” means it's a directory. You'll see 3 sets of “rwx” after it.

Notice in the above example, the directory “bin” also have the execute bits on (the “x”) for all {owner, group, other}. That is because, in order to list directory content, the directory not only needs the read permission on, but due to unix idiosyncrasy, it must also have the execute bit on. (unix perm system is badly designed.)

Here's another example showing different users and groups.

  /:
  total used in directory 14611 available 21849492
  drwxrwxr-t   38 root  admin     1394 Jun 10 11:07 .
  drwxrwxr-t   38 root  admin     1394 Jun 10 11:07 ..
  -rw-rw-r--    1 root  admin    21508 Jun 10 11:56 .DS_Store
  drw-------    9 root  admin      306 Nov  9  2005 .Spotlight-V100
  d-wx-wx-wt    2 root  admin       68 Oct  8  2005 .Trashes
  -rw-------    1 root  wheel  1048576 Nov  9  2005 .hotfiles.btree
  dr-xr-xr-x    2 root  wheel      128 Jun 10 11:07 .vol
  drwxrwxr-x   71 root  admin     2414 Jun 10 11:56 Applications
  drwxrwxr-x   17 root  admin      578 Oct 13  2007 Applications (Mac OS 9)
  -rw-rw-r--    1 root  admin   196608 Jun  7 18:26 Desktop DB
  -rw-rw-r--    1 root  admin  1223010 Mar  1 14:55 Desktop DF
  drwxrwxr-x    2 root  admin       68 Sep 26  2003 Desktop Folder
  drwxrwxr-x   17 root  admin      578 Mar 14  2008 Developer
  drwxrwxr-t   49 root  admin     1666 Jul 17  2006 Library
  drwxr-xr-x    1 root  wheel      512 Jun 10 11:09 Network
  drwxr-xr-x    4 root  wheel      136 Jun 10 11:08 System
  drwxrwxr-x   35 root  admin     1190 Dec  1  2005 System Folder
  drwxr-xr-x    2 o     admin       68 Nov 18  2005 TheVolumeSettingsFolder
  lrwxr-xr-x    1 root  admin       60 Nov  9  2005 User Guides And Information -> /Library/Documentation/User Guides and Information.localized
  drwxrwxr-t    9 root  admin      306 Jan 10 17:12 Users
  drwxrwxrwt    5 root  admin      170 Jun 10 11:10 Volumes
  drwxr-xr-x    4 root  admin      136 Nov  9  2005 automount
  drwxr-xr-x   40 root  wheel     1360 May 13 08:50 bin
  drwxrwxr-t    3 root  admin      102 Mar 25  2006 cores
  dr-xr-xr-x    2 root  wheel      512 Jun 10 11:07 dev
  lrwxr-xr-x    1 root  admin       11 Oct  8  2005 etc -> private/etc
  lrwxr-xr-x    1 root  admin        9 Jun 10 11:07 mach -> /mach.sym
  -r--r--r--    1 root  admin   604360 Jun 10 11:07 mach.sym
  -rw-r--r--    1 root  wheel  4352200 Oct 17  2007 mach_kernel
  drwxr-xr-x    3 root  wheel      102 Apr 14  2006 opt
  drwxr-xr-x    7 root  wheel      238 Jun 10 11:07 private
  drwxr-xr-x   63 root  wheel     2142 May 13 08:50 sbin
  -rw-r--r--    1 xah   admin        0 Jul 23  2008 siplog.txt
  drwxr-xr-x   12 root  admin      408 Jul  9  2008 sw
  lrwxr-xr-x    1 root  admin       11 Oct  8  2005 tmp -> private/tmp
  -rw-r--r--    1 xah   admin       23 Feb 27 22:09 url_history.xml
  drwxr-xr-x   11 root  wheel      374 Nov 10  2005 usr
  lrwxr-xr-x    1 root  admin       11 Oct  8  2005 var -> private/var

For example, let's look at this line

  drwxr-xr-x   11 root  wheel      374 Nov 10  2005 usr

Changing File's {owner, group} and Permissions

You can use the following commands to change file's {owner, group}:

To list existing users and groups, see: Linux: Users and Groups

You can use the following commands to change permission:

These commands use 3 octal digits to specify the 3 sets of perm bits. See man chown, man chgrp.

# set mycat.jpg file's perm to 644, which is rw-r--r--
chmod 644 mycat.jpg

Memorize Perm Bits Octal Conversion

Here's how to memorize the perm in octal:

So, add them together. For example, if you want “r--”, then that's 4. if you want “r-x”, then that's 5. Do this for each of the {owner, group, other} perm set, then you get 3 digts. For example, “rw-r--r--” is 644.

644 is the most common for files. 755 is the most common for dirs.

Change Multiple Files Perm in Batch

To change multiple files in batch, you can use the command find to traverse a dir. Example:

# set all files under current dir to 644, which is rw-r--r--
find . -type f -print0 | xargs -0 -l -i chmod 644 '{}'

# set all dirs under current dir to 755, which is rwxr-xr-x
find . -type d -print0 | xargs -0 -l -i chmod 755 '{}'

〔►see Linux: Shell Command Examples: find, xargs